Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the execution of the Kothamine injector by correlating three distinct stages: the use of PowerShell to create an AV exclusion for 'MicrosoftEdgeUpdateCore', the dropping of the 'MicrosoftEdgeUpdateCore' binary into the user's AppData directory, and subsequent process injection (OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) into explorer.exe.
Detects the execution of the Kothamine injector by correlating three distinct stages: the use of PowerShell to create an AV exclusion for 'MicrosoftEdgeUpdateCore', the dropping of the 'MicrosoftEdgeUpdateCore' binary into the user's AppData directory, and subsequent process injection (OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) into explorer.exe.
Detects the execution of the Kothamine injector by correlating three distinct stages: the use of PowerShell to create an AV exclusion for 'MicrosoftEdgeUpdateCore', the dropping of the 'MicrosoftEdgeUpdateCore' binary into the user's AppData directory, and subsequent process injection (OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) into explorer.exe.
Detects the execution of the Kothamine injector by correlating three distinct stages: the use of PowerShell to create an AV exclusion for 'MicrosoftEdgeUpdateCore', the dropping of the 'MicrosoftEdgeUpdateCore' binary into the user's AppData directory, and subsequent process injection (OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) into explorer.exe.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI). This rule monitors for command-line arguments indicative of reflection-based patching of AmsiUtils and forced AmsiScanBuffer failures, as well as registry modifications to AMSI providers.
Detects sophisticated in-memory loader activity characterized by a sequence of events: process module loads involving AMSI patching (amsi.dll), fresh ntdll.dll remapping to bypass EDR hooks, and the enumeration of hypervisor-related drivers or services, often associated with advanced payload execution chains like ClickFix.
Detects instances where a process loads both amsi.dll and the .NET CLR (clr.dll or mscoree.dll) within a 60-second window, excluding known legitimate .NET and PowerShell hosts. This behavior is indicative of an in-memory shellcode loader attempting to bypass AMSI protections before executing .NET payloads in memory, a technique frequently observed in sophisticated malware campaigns.
Detects the CLOSEDQUORUM implant communicating with multiple LLM providers (DeepSeek, Qwen, Mistral, or Gemini) for quorum-based decision making, followed by the same process spawning or injecting into a legitimate Windows system process (e.g., svchost, explorer) to conduct post-exploitation activities.
Detects potential process injection attempts where a process is created in a suspended state (often used for hollowed or injected code) and subsequently performs sensitive remote memory or thread operations (e.g., NtAllocateVirtualMemoryRemote, WriteProcessMemoryRemote) on that process.
Detects the modification of the Image File Execution Options (IFEO) registry key for 'smss.exe' to set a Debugger value. This technique is often used for persistence, whereby an adversary redirects the execution of a legitimate system process to a malicious executable (e.g., a renamed binary like svchost.exe located outside of System32).
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects the loading of the malicious NvFsFilter driver (a BYOVD technique often used by the Rapuncel infostealer) followed immediately by a mass burst of process terminations, indicating an attempt to disable security software.
Detects PavokwiLoader behavior where a potentially malicious process spawns a browser or system process (e.g., smartscreen.exe) in a suspended state, followed by cross-process memory allocation and writing, and subsequent thread hijacking or execution resumption, indicating a process hollowing injection technique.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects potential process injection attempts (e.g., Early Bird APC injection or process hollowing) where a process is spawned in a suspended state, followed shortly by a remote-thread or QueueUserAPC injection primitive targeting that same process. The rule correlates process creation events with subsequent API calls while excluding known legitimate patterns like .NET runtime operations, system updaters, and EDR/AV security components.
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects the use of PowerShell cmdlets (Add-MpPreference or Set-MpPreference) to modify Microsoft Defender exclusions (paths, processes, or extensions). This behavior is often associated with adversaries attempting to evade security detection by excluding malicious files or processes from being scanned by Microsoft Defender.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to inhibit system recovery by deleting shadow copies, backup catalogs, or disabling automatic recovery features. This behavior is commonly observed in ransomware attacks.
This rule detects the loading of known-vulnerable or malicious kernel drivers (BYOVD) followed by the termination of major EDR or security-related processes on the same host within a 10-minute window. This behavior is indicative of an adversary attempting to disable security controls to evade detection after achieving kernel-level privileges.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects the presence of the signed but vulnerable DCRCVDrv.sys kernel driver, which is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security processes via an unauthenticated PID-terminate IOCTL.
Page 4 of 52